CVE-2026-109200 | BDVDB-2026-386271 Detail
LogicalDOCLogicalDOC Community Edition
Description#
LogicalDOC Community Edition through 9.3 contains a server-side request forgery vulnerability in the default-enabled XMLConverter that fetches xml-stylesheet href URLs without scheme or host allowlisting. Authenticated users can upload XML documents whose stylesheet href points to internal http, ftp, file, or jar URLs, forcing server requests and applying attacker-controlled XSLT during conversion.
Impact#
Per CVSS v3.1: confidentiality impact low, integrity impact low, availability impact none. Attack vector: network.
Weaknesses#
- CWE-918 Server-Side Request Forgery (SSRF)
References#
- https://github.com/logicaldoc/community/discussions/119
- https://github.com/logicaldoc/community/blob/9.3/logicaldoc-core/src/main/java/com/logicaldoc/core/conversion/XMLConverter.java#L249
- https://github.com/logicaldoc/community/blob/9.3/logicaldoc-core/src/main/java/com/logicaldoc/core/conversion/XMLConverter.java#L106
- https://github.com/logicaldoc/community
- https://www.vulncheck.com/advisories/logicaldoc-community-edition-through-9.3-ssrf-via-xmlconverter-xml-stylesheet-href
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.